Merge commit from fork

* fix: add `Scopes` to `Request` interface so that scopes can be validated on all requests

* feat: assert org from scope exists when authorizing requests

* fix: check all scopes

* comments

* check org on callback creation

* fix tests

* clarifications

* fix scope marshaling

* fix: enfore organization for authrequest in initiation

* fix: filter sessions on the accounts page by organization scope

* add integration tests

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>

internal/command/device_auth_model.go

@@ -29,6 +29,7 @@ type DeviceAuthWriteModel struct {
 	UserAgent         *domain.UserAgent
 	NeedRefreshToken  bool
 	SessionID         string
+	OrganizationID    string
 }
 
 func NewDeviceAuthWriteModel(deviceCode, resourceOwner string) *DeviceAuthWriteModel {
@@ -53,6 +54,7 @@ func (m *DeviceAuthWriteModel) Reduce() error {
 			m.Audience = e.Audience
 			m.State = e.State
 			m.NeedRefreshToken = e.NeedRefreshToken
+			m.OrganizationID = e.OrganizationID
 		case *deviceauth.ApprovedEvent:
 			m.State = domain.DeviceAuthStateApproved
 			m.UserID = e.UserID